from __future__ import annotations

import ast
import subprocess
import sys
from pathlib import Path

ROOT = Path(__file__).parents[1]


def test_authentik_payload_is_valid_python_and_never_prints_secret() -> None:
    path = ROOT / "scripts" / "authentik_provision_mcp_service_account.py"
    source = path.read_text(encoding="utf-8")
    ast.parse(source)
    assert "INTENT_APP_PASSWORD" in source
    assert '"subject": str(user.uuid)' in source
    assert "print(secret" not in source
    assert '"key": secret' in source


def test_codex_installer_uses_stdio_bridge_and_secret_reference_only() -> None:
    source = (ROOT / "scripts" / "install_codex_mcp.ps1").read_text(encoding="utf-8")
    assert "mcp_stdio_bridge.py" in source
    assert "--client-secret-file" in source
    assert "mcp', 'add'" in source
    assert "Secret file ACL must grant only" in source
    assert "Secret file must already be owned" in source
    assert "SetOwner" not in source
    assert "Set-Acl" not in source
    assert "Get-Content" not in source
    assert "WriteAllText" not in source


def test_stdio_bridge_starts_outside_repository_working_directory(tmp_path: Path) -> None:
    result = subprocess.run(  # noqa: S603
        [sys.executable, str(ROOT / "scripts" / "mcp_stdio_bridge.py"), "--help"],
        cwd=tmp_path,
        capture_output=True,
        check=False,
        text=True,
        timeout=60,
    )
    assert result.returncode == 0, result.stderr
    assert "ITWorx MCP stdio bridge" in result.stdout


def test_machine_client_provisioner_imports_outside_repository(tmp_path: Path) -> None:
    result = subprocess.run(  # noqa: S603
        [
            sys.executable,
            str(ROOT / "scripts" / "provision_machine_client.py"),
            "--issuer",
            "https://auth.itworx.test/application/o/hub/",
            "--subject",
            "fixture-subject",
            "--oauth-username",
            "svc-fixture",
            "--name",
            "Fixture",
            "--project",
            "fixture",
            "--database-url",
            "sqlite:///:memory:",
        ],
        cwd=tmp_path,
        capture_output=True,
        check=False,
        text=True,
        timeout=60,
    )
    assert result.returncode == 1
    assert "ModuleNotFoundError" not in result.stderr


def test_credential_generator_uses_csprng_and_user_only_acl() -> None:
    source = (ROOT / "scripts" / "new_codex_credential.ps1").read_text(encoding="utf-8")
    assert "RandomNumberGenerator" in source
    assert "SetAccessRuleProtection($true, $false)" in source
    assert "Set-Acl" in source
    assert "Write-Output $path" in source
    assert "Write-Output $value" not in source